Bounds check hoisting currently fails for accesses of the form x[v + i], when x and v are loop invariant. Array traversals in autoranslated code will look like this, rather than the usual x[i], as x is a big typed array and v is the base address of some allocated subarray of x.

Comment on attachment 639994 [details] [diff] [review] patch Review of attachment 639994 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/LICM.cpp @@ +465,5 @@ > > + // Check if lhs in the conditional matches the bounds check index, in > + // either the form (lhs + indexN) or (lhs + extra + indexN) for loop > + // invariant extra. The latter pattern is important for JS translated from > + // C/C++, where the accessed array is a giant typed array and y indicates What does "y" refer to in this comment? @@ +504,2 @@ > return; > + } while (0); Please separate out the above block into a separate function, since tryHoistBoundsCheck is getting pretty long.